What information is present in an Email Header that can be used to track a sent mail? For example, are some of these present?
- Web Browser used?
- Operating system
- Type of Network (broadband/dial up)?
- Type of system Laptop/Desktop etc.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Some of the most useful headers are:
usually reveals client MUA and version, often OS and architecture
all sorts of things, overall you get to see (most of) the store-and-forward hops, but within each such header you can see:
Receivedusually indicates the client that originated the SMTP message, in the past I've used a regex on the reverse DNS name added by sendmail to tag potential DSL/domestic naming conventions:
Message-IDif MUA generated it may reveal MUA details, and may contain host identifying information. If added by the first hop it may reveal MTA details. This field is intended to uniquely identify a specific message.
Return-Paththe envelope sender, may indicate attempted forgery
X-headers often reveal scanning, anti-virus, anti-spam components; TLS support. Many systems (including MS-Exchange) add
X-Originating-IP. Hotmail adds an "obscured" X-EIP (evidently a source of much excitement).
Received headers, the
X- headers are likely the most informative, but system specific and not always well defined, or documented (by their nature).
However, your question is phrased so that you are most likely talking about webmail originated messages. Browser+webmail is of course not an SMTP based MUA, the construction of the SMTP message happens server-side (the webmail software in effect becoming the email client). There's a further complication here too: a HTTP proxy may hide the client from the webmail server (analogous to an open SMTP relay).
It's up to the webmail provider as to how much client detail (usually very little) is included in the headers, the client (browser) IP is not typically included. Gmail say it might be there, I've observed that it's not for web mail, but it is for SMTP submitted mail, and see this discussion: Email headers from messages sent via Gmail online client contain private IP addresses. What are these addresses? . Hotmail obscures it (see above)
For the four specific items you ask about: you might get the IP, and hence the whois/reverse-DNS, which should tell you something about the source network. The other items, no, not for webmail.
See this for some discussion of IP addresses in headers: Email header IP address
The webmail provider will (in theory) be able to track an email in their own logs, using one or more of the Message-ID, the queue/spool ID (recorded in
Received), or a custom message identifier (possibly in an
It's also worth remembering that SMTP is a fairly loose protocol, any "synthetic" headers injected by a sender (or malicious server) are dutifully passed on. Systems such as DKIM allow at least testing the authenticity and integrity of some headers.
The RFC 5322 defines what email message headers should look like, and some of the required ones like
Message-ID. Most email headers are actually optional and appended to the message by the client and email relays for traceability, usability, and debugging purposes. The email message can contain any number of the 350+ recognized ones. It can also contain any number of custom headers.
Nothing stops Hotmail, GMail, or others from appending the browser's user-agent field to the email headers. Nothing stops Thunderbird from appending your connection type and details about your operating system. However, currently, email clients (web-based or desktop) don't append such information to the email message headers. We're also not aware of web-based email services appending information they have on you to the email message headers.